Consumer Health Data Privacy Policy

Consumer Health Data We Collect

VeteranRecord is a place to keep your medical records, so most of what's in it is health data:

• Allergies, and the reactions and treatments recorded with them.
• Health conditions and diagnoses, how they're managed, and emergency notes.
• Vaccines given, and next dose dates you enter.
• Illnesses and injuries, symptoms, temperature, pain and check-in notes.
• Medicines, what they're for, who prescribed them, times of day, and every dose recorded.
• Measurements: height, weight, head size, blood pressure, heart rate, temperature.
• Lab, imaging, procedure, dental and other records, and the photos and files of them.
• Blood type.
• Doctors and other care providers, and appointments and other reminders you set.
• Health insurance details and card photos.
• Photos you choose to scan (vaccine cards, medicine labels, insurance cards) and what was read from them.
• Files from your doctor you choose to import (a record file or a PDF), and what you keep from them.

We don't collect precise location, biometric data, or information from health devices or other apps, and we don't use geofencing.

Why We Collect It and How We Use It

• To store your records and show them to you and the people you choose.
• To do what you ask with them: visit summaries, forms, share links, reminders, reading photos you scan.
• To keep your account and your information secure.

We don't use it for advertising, sell it, or use it to train AI models.

Where It Comes From

• You, when you enter it or add a photo or file.
• Helpers you invite, when they add to your record.
• Photos you choose to scan, and PDFs you choose to import, read by our scanning provider (see below).

Who We Share It With

• Helpers you invite, as you set it up: full access (add and change, never delete) or view only, and only during any time you set. They never see entries you mark private.
• People you send a link to, such as a doctor, a VSO or an attorney: only what's on that summary or evidence packet, until the link expires or you stop it. Anyone with your emergency card link or QR code sees only the emergency card, until you stop it.
• Our processors, who handle it only on our instructions to run the service: Supabase (database, login and file storage), Vercel (hosting), Resend (account emails, reminder and refill emails you turn on, and any feedback you send us, which may mention health details if you include them), and Anthropic (reading photos you choose to scan, and photos and PDFs you choose to import or upload).

We have no affiliates that receive consumer health data, and we don't share it with anyone else unless the law requires it.

Your Consent

We collect consumer health data with your consent, which you give when you create your account, and only as needed to provide VeteranRecord. We ask separately before you scan your first photo, because scanning sends the photo to another company to be read. We won't share your health data for any other purpose, or sell it, without asking for your separate consent first.

Your Rights and How to Use Them

You have the right to:

• Confirm whether we collect, share or sell your consumer health data, and see it.
• Get a list of every third party and processor we've shared it with, and how to contact them.
• Withdraw your consent to us collecting and sharing it.
• Have it deleted, including from our processors.

Much of this you can do yourself in the app: see and delete any entry, stop share links, and delete your account in Settings. For anything else, email [privacy email address] with "Health data request" in the subject, or write to [mailing address]. A helper can't make requests about the record they help with; the record's owner can.

We'll check it's really you (usually by asking you to write from the email address on your account) and reply within 45 days. If we need more time, we'll tell you why within those 45 days, and take no more than 45 more. It's free, up to twice a year.

Appeals

If we turn down your request, you can appeal by replying to our answer or emailing [privacy email address] with "Appeal" in the subject. We'll answer within 45 days and explain our decision. If you're still not satisfied, you can contact the Washington State Attorney General at atg.wa.gov/file-complaint.

Contact Us

[company legal name]
[mailing address]
[privacy email address]